Wyoming County, New York: ThreeAM Ransomware Leak Site Listing

"The ThreeAM ransomware group has listed Wyoming County, New York (wyomingcountyny.gov) on its leak site. It has also published file and folder listings that it says came from the county government's systems. Siberpol's…"

The ThreeAM ransomware group has listed Wyoming County, New York (wyomingcountyny.gov) on its leak site. It has also published file and folder listings that it says came from the county government's systems. Siberpol's threat intelligence unit reported the listing. It says the group announced the victim on 1 May 2026 and gave 2 June 2025 as the date of the attack. ThreeAM has not said how much data it took, how many files are involved or what ransom it wants. Wyoming County has not publicly confirmed a breach. No breach notice from the county has been published, and no state agency has published an advisory naming the county. This brief treats the leak as a criminal claim that has not been independently confirmed.

What Happened

Siberpol's report gives three dates:

2 June 2025: the attack date ThreeAM claims.
1 May 2026: the date the group announced Wyoming County on its leak site.
10 November 2026: the date Siberpol published its report.

That is almost a year from the claimed intrusion to the listing, and six more months before public reporting. The reason for the gap is unclear. One possibility is that the county and the group were in private negotiations that failed. Another is that the claimed date is wrong. A third is that the group is reposting old or recycled data. None of these can be confirmed from what is public.

Siberpol describes the post as a data leak, meaning the group is now using the threat of publication to pressure the victim. ThreeAM backed its claim the way most ransomware groups do: it posted directory structures and file names, not a full archive. Siberpol notes that little public information exists about ThreeAM's activity against this victim. The county has not said whether systems were encrypted, whether services were disrupted, or whether it has brought in outside incident response.

What Was Taken

According to Siberpol's reading of the leak post, ThreeAM claims the data includes:

Administrative records
Technical files
Financial records

The screenshots show folder names. One begins with "ADA", which may point to Americans with Disabilities Act compliance or accommodation files. Another begins with "Admi", likely administration. The full names are cut off in the available reporting.

No data volume, file count or record count has been published, either by the group or by anyone who has reviewed the files. That means nobody can yet say how many residents or employees might be affected. County governments usually hold a lot of personal data: payroll and HR files, benefits and social services case records, tax and property records, court and public safety documents. If the published files include Social Security numbers, driver's licence numbers or financial account details, New York's breach rules would likely require notification. That depends on what the files actually contain, and no one outside the group has verified the contents.

Why It Matters

Small county governments are a steady target for ransomware groups. They run critical services on small IT budgets, often with only a few staff and old infrastructure. Wyoming County is a rural county of about 40,000 people in western New York, which fits that profile.

The listing comes amid wider New York data breach enforcement. On 6 November 2026, Attorney General Letitia James announced a settlement with four other states against Perry Johnson & Associates and four related medical transcription and coding companies. The case concerned a March 2023 breach. The Attorney General's office says it affected about 13.3 million people nationally, including about 4.2 million New Yorkers. Malwarebytes notes that earlier reporting put the total at about 8.95 million. It adds that the real figure could be higher, because the companies did not review files the attackers reached in shared network storage.

The settlement headline says "up to $10 million". FingerLakes1 and Malwarebytes both point out that only $300,000 is owed now. The other $9.7 million is due only if the companies break the settlement terms.

The investigation's findings are worth noting. Attackers logged into a remote access system that had no multifactor authentication, using a stolen employee password. They then collected more passwords from unencrypted files. Monitoring software recorded the activity but had no alerts set up. The companies only found out when the attackers contacted them about two months later to demand payment. Those same weaknesses show up again and again in local government ransomware cases.

Notification obligations. A guide to New York law from cybersecurity.guru says General Business Law 899-aa requires notice to affected residents within 30 days of discovering a breach. Notice must also go to the Attorney General, the Department of State and the State Police. Lavawall's multi-state review notes that New York is one of a minority of states with a fixed deadline. Public bodies can face separate or extra rules, so which notice route applies to a county government is a question for the county's lawyers. No notice from Wyoming County has appeared publicly.

The Attack Technique

How ThreeAM got into Wyoming County's network is not known. The group has not said, and the county has not disclosed findings from any investigation.

Past research on ThreeAM (also written 3AM) gives defenders some useful patterns:

Its origins. Symantec first reported it in 2023 as ransomware written in Rust. A LockBit affiliate used it when LockBit itself was blocked.
Its typical approach. Sophos reported in 2025 that ThreeAM affiliates combined two tactics. First they flooded victims with junk email. Then they called staff pretending to be the IT help desk and talked them into allowing remote access.

These are general patterns. They have not been linked to the Wyoming County incident.

Two recent reports describe ways into government and enterprise networks that defenders should watch. Neither has been linked to Wyoming County or to ThreeAM.

AhsayCBS backup consoles. Huntress has been tracking exploitation of two flaws in AhsayCBS, the management console for Ahsay backup software. CVE-2026-105133 lets attackers bypass authentication. CVE-2026-105134 lets them run code as SYSTEM without logging in. On servers breached in October 2026, Huntress found:
five families of webshells, including one that hides encrypted payloads inside PNG image data
a cryptominer
a Python implant that connects to a command server
tunnelling tools and broad exclusions in Microsoft Defender
a command consistent with stealing Veeam credentials

Huntress concludes the operator may have been going after backup infrastructure in particular, which is exactly what ransomware crews disable before they encrypt. Ahsay has released hotfixes 10.3.4.45 (v10) and 9.15.2.70 (v7 to v9). - BeyondTrust Remote Support. New York's Office of Information Technology Services (ITS) issued advisory 2026-118 on 20 October 2026 for CVE-2026-102764, a file upload flaw in BeyondTrust Remote Support versions 26.2.3 and earlier. ITS cites Mandiant, which says a suspected Chinese espionage group it tracks as ARMORY CASTLE (formerly UNC5221) used the flaw before a patch existed, in late August 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 16 October. ITS rates the risk as high for large and medium government bodies and medium for small ones.

What Organizations Should Do

Patch remote access and backup consoles first. Upgrade BeyondTrust Remote Support beyond 26.2.3 and apply the Ahsay hotfixes. Then hunt for webshells, unexpected scheduled tasks and Defender exclusions on those hosts. Patching does not remove access an attacker already has.
Require multifactor authentication on every remote access path. That includes VPN, remote support tools and vendor accounts. The Perry Johnson breach started with a single password on a remote access system that had no MFA.
Protect backups from attackers. Keep offline or immutable copies. Put backup management consoles on a separate network segment. Change Veeam and other backup service credentials if those systems may have been exposed.
Prepare staff for fake help desk calls. Tell employees the IT department will never call them unprompted and ask them to run Quick Assist or another remote tool. Give them a clear way to check, and limit which remote support tools can run on staff machines.
Turn on alerting, not just logging. Make sure security tools send alerts to someone who will act on them. Investigators found that Perry Johnson's software recorded the intrusion but nobody was told.
Find where personal data lives before an incident. Map where HR, payroll, social services and financial data sit, and encrypt it at the file level. Set up the 30-day notification process now so a leak site listing does not start the clock on a team that isn't ready.

Sources: ThreeAM ransomware group lists wyomingcountyny.gov on its leak site | Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and... | Attorney General James Secures Up to $10 Million and Critical Refor... | 13.3 million people’s medical data exposed; companies pay $300,000... | Medical data breach settlement requires reforms after 4.2 million N... | New York Data Breach Notification Law: Deadlines and Notices | US state data breach notification: Lavawall® | A Vulnerability in BeyondTrust Remote Support Could Allow for Arbit...